EUVD-2026-44439
GHSA-8m86-2cxp-pw9w
Severity by source
AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
File must be opened locally (AV:L, UI:R); the opening user needs no special privilege so PR:N (contra Adobe's PR:H); code runs in current user context so S:U with full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run OS commands in the context of the current user when a victim opens a maliciously crafted file. The flaw is an OS command injection (CWE-78) with no public exploit identified at time of analysis and no active exploitation reported in CISA KEV; risk hinges on social-engineering a user into opening the file. Adobe published fixes in advisory APSB26-83.
Technical ContextAI
Adobe Animate is a desktop authoring application for interactive animation and multimedia content (successor to Flash Professional), affecting the 2023 and 2024 release lines per CPE strings cpe:2.3:a:adobe:adobe_animate_2023 and cpe:2.3:a:adobe:adobe_animate_2024. The root cause class is CWE-78, Improper Neutralization of Special Elements used in an OS Command: attacker-controlled data embedded in a crafted project or asset file reaches an OS-level command interpreter without proper sanitization, so shell metacharacters or command fragments are executed by the host rather than treated as inert data. This is a file-parsing / client-side attack surface typical of rich desktop content editors that shell out to helper processes during file load or asset processing.
RemediationAI
Apply the updates referenced in Adobe security bulletin APSB26-83 (https://helpx.adobe.com/security/products/animate/apsb26-83.html) for Adobe Animate 2023 and 2024; the exact fixed build numbers are listed in that advisory and should be pulled directly from it rather than assumed. Patch available per vendor advisory. As compensating controls until patching, restrict opening of untrusted Animate project and asset files (treat .fla and imported assets from email or web downloads as untrusted), enforce application allowlisting or run Animate under a least-privileged, non-administrative account to limit the blast radius of any injected command, and use email/web gateway filtering to block delivery of unsolicited Animate project files; the trade-off is workflow friction for teams that legitimately exchange Animate files, so pair these controls with user awareness training on not opening unexpected project files.
More in Adobe Animate 2023
View allArbitrary code execution in Adobe Animate 2023 and 2024 stems from a path traversal weakness triggered when a victim ope
Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run commands in the context of the current
Arbitrary code execution in Adobe Animate 2023 and 2024 stems from an incorrect authorization (CWE-863) weakness that le
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an untrusted search path (CWE-426) flaw that lets a
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an Incorrect Authorization flaw (CWE-863) that lets
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today